Tampered Claude Code Extension Planted SSH Backdoor on Cursor

For about 11 hours on October 29, a tampered build of Anthropic's own Claude Code extension sat inside Cursor's official marketplace — not a lookalike, not a typo-squatted clone, but a modified version published under the real extension's own identity. Cursor says up to 5,000 users downloaded it before anyone caught on.

A backdoor hiding in plain sight

Cursor is a popular AI-powered code editor built on top of Visual Studio Code, and its built-in marketplace is where developers grab plugins the same way you'd grab an app from a phone's app store. One of the most-installed plugins there is Claude Code, Anthropic's coding assistant, which plugs directly into the editor so developers can write, review, and refactor code with AI help without leaving their workspace.

Somewhere along the way, a malicious build of that extension — version 2.1.313 — replaced the legitimate one on Cursor's marketplace. It carried Anthropic's real extension ID, so there was nothing in the listing itself that would have tipped off a careful developer. Cursor pulled the package once it was flagged, briefly took its marketplace offline, and pushed users toward version 2.1.314 as the clean replacement.

What the malicious code actually did

According to security researchers who examined the tampered build, it quietly planted an attacker-controlled SSH key on the infected machine. SSH is the standard way developers log into remote servers securely — think of it as a digital spare key that's normally only ever cut for the computer's actual owner. By inserting their own key, the attacker could keep logging back into a compromised developer's machine whenever they wanted, even after the malicious extension itself was deleted. That's what makes it a "backdoor": the damage doesn't go away just because you uninstall the thing that caused it.

It's worth being upfront about what's still murky here. Cursor hasn't published a detailed account of exactly how the tampered build made it onto its marketplace in the first place, and outside researchers have floated competing theories about the entry point. What is confirmed is that the extension wasn't built by Anthropic, and that other distribution channels for Claude Code — Microsoft's own VS Code marketplace and the open-source Open VSX registry — weren't affected.

"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded through our marketplace." — Cursor, official statement

Why a 5,000-user incident is still worth your attention

Five thousand affected accounts sounds small next to a billion-record data breach, but the shape of this incident is what matters more than the headcount:

• It used the extension's real, verified identity — there was no suspicious name or icon to spot
• It rode in through an auto-updating channel, meaning plenty of victims did nothing wrong beyond having auto-updates turned on
• The SSH backdoor persists even after the bad extension is gone, so a simple uninstall isn't enough to be safe
• It targeted developer machines specifically, which often hold access to production servers, client codebases, and cloud credentials

What this means for developers in India

Cursor and Claude Code have found an outsized audience among Indian developers over the past couple of years — at startups moving fast with small teams, inside the global capability centres that large companies have set up in Bengaluru, Hyderabad, and Pune, and among IT services engineers who are increasingly expected to ship with AI pair-programming tools baked into their daily workflow. That scale of adoption is exactly what makes this incident relevant here, not peripheral. A developer in an Indian GCC or services firm is often sitting on SSH access to client production infrastructure, which raises the stakes of a persistent backdoor considerably beyond a personal side project. Bug bounty programs exist precisely to catch this kind of tampering before it reaches users, but marketplace-level supply chain attacks like this one slip past that model entirely since the flaw isn't in the product's own code — it's in the distribution pipeline.

The takeaway

If your team uses the Claude Code extension through Cursor, the practical move is to confirm you're on version 2.1.314 or later and to check your machine's list of authorized SSH keys for anything you don't recognize — removing a bad extension doesn't revoke a key it already planted. The bigger lesson is less comfortable: as AI coding assistants become as routine as the editor itself, their marketplaces are turning into a genuine piece of software supply chain infrastructure, and they deserve the same scrutiny teams already apply to package registries like npm or PyPI. An extension's official badge and real ID used to be a reasonable signal of trust. This incident is a reminder that it no longer is one by itself.